From af37d9766c5fe4e256e07faefa095535ba4c993c Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Thu, 29 Oct 2026 08:30:32 -0400 Subject: vgsp: per-channel C597 attachment table, sema_gl_win_drop strip knob, WINPROBE; strip experiment: binds-only windows retire, full draws die in FECS switch-in (SESSION 153 r955-r958) --- kernel/gsp_sema_service.c | 182 +++++++++++++++++++++++++++++++++++++++------- 1 file changed, 157 insertions(+), 25 deletions(-) (limited to 'kernel/gsp_sema_service.c') diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index ac6f392..6d2bee7 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -7152,6 +7152,104 @@ static u8 svc_gl_shader_type[32] = { static u64 svc_gl_att_h; /* channel whose subch carries the C597 bind */ static u32 svc_gl_att_subch; static u32 svc_gl_draw_log; /* bounded draw-section-open witness */ +/* + * SESSION 153-CONTINUED-13: the C597 attachment is per-channel. The single + * (h_object, subch) slot was overwritten by the RM channel's periodic + * C597-bind pushes (h=0xbfef0002, observed every ~7 s on this boot), after + * which the GLX client's draw pushes on 0x1000013 failed the BEGIN + * recogniser's `svc_gl_att_h == ch->h_object` test and no draw section was + * ever opened (a boot-level, order-dependent race: the r954 boot decoded + * no such pushes). A small table (first match wins, dedup on note) keeps + * every channel's bind sticky independently, so the draw channel's + * attachment cannot be stolen. + */ +#define SVC_GL_ATT_MAX 8 +static u64 svc_gl_att_tab_h[SVC_GL_ATT_MAX]; +static u8 svc_gl_att_tab_sub[SVC_GL_ATT_MAX]; + +static void svc_gl_att_note(u64 h, u32 subch) +{ + u32 i, free = SVC_GL_ATT_MAX; + + for (i = 0; i < SVC_GL_ATT_MAX; i++) { + if (svc_gl_att_tab_h[i] == h && + svc_gl_att_tab_sub[i] == (u8)subch) { + /* refresh LRU position: move to slot 0 */ + if (i) { + memmove(&svc_gl_att_tab_h[1], + &svc_gl_att_tab_h[0], + (size_t)i * sizeof(u64)); + memmove(&svc_gl_att_tab_sub[1], + &svc_gl_att_tab_sub[0], + (size_t)i); + svc_gl_att_tab_h[0] = h; + svc_gl_att_tab_sub[0] = (u8)subch; + } + return; + } + if (!svc_gl_att_tab_h[i] && free == SVC_GL_ATT_MAX) + free = i; + } + if (free == SVC_GL_ATT_MAX) { + /* table full: evict the oldest (last) slot */ + free = SVC_GL_ATT_MAX - 1; + } + memmove(&svc_gl_att_tab_h[1], &svc_gl_att_tab_h[0], + (size_t)free * sizeof(u64)); + memmove(&svc_gl_att_tab_sub[1], &svc_gl_att_tab_sub[0], + (size_t)free); + svc_gl_att_tab_h[0] = h; + svc_gl_att_tab_sub[0] = (u8)subch; + /* keep the legacy single slot pointing at the newest note (logging) */ + svc_gl_att_h = h; + svc_gl_att_subch = subch; +} + +static bool svc_gl_att_has(u64 h, u32 subch) +{ + u32 i; + + for (i = 0; i < SVC_GL_ATT_MAX; i++) + if (svc_gl_att_tab_h[i] == h && + svc_gl_att_tab_sub[i] == (u8)subch) + return true; + return false; +} + +static u32 svc_gl_att_subch_of(u64 h) +{ + u32 i; + + for (i = 0; i < SVC_GL_ATT_MAX; i++) + if (svc_gl_att_tab_h[i] == h) + return svc_gl_att_tab_sub[i]; + return 0xffu; +} + +static void svc_gl_att_clear(u64 h, u32 subch) +{ + u32 i; + + for (i = 0; i < SVC_GL_ATT_MAX; i++) + if (svc_gl_att_tab_h[i] == h && + svc_gl_att_tab_sub[i] == (u8)subch) { + u32 n = SVC_GL_ATT_MAX - 1 - i; + + if (n) + memmove(&svc_gl_att_tab_h[i], + &svc_gl_att_tab_h[i + 1], + (size_t)n * sizeof(u64)); + if (n) + memmove(&svc_gl_att_tab_sub[i], + &svc_gl_att_tab_sub[i + 1], + (size_t)n); + svc_gl_att_tab_h[SVC_GL_ATT_MAX - 1] = 0; + svc_gl_att_tab_sub[SVC_GL_ATT_MAX - 1] = 0; + if (svc_gl_att_h == h) + svc_gl_att_h = svc_gl_att_tab_h[0]; + return; + } +} /* * SESSION 153 (G-B gate: the client's own C597 draws must open sections). * The replay guard at svc_gl_flush consults svc_gr_cand_push_seen(), which @@ -7411,7 +7509,13 @@ static void svc_gl_hold_store(u32 h, u64 prog, u64 param, u32 psize, { u32 i, free = SVC_GL_HOLD_MAX; - if (!h || !prog || !param || !rel) + /* + * SESSION 153-CONTINUED-13: rel == 0 is admitted (a section that has + * real operands but flushed before the channel's release was decoded + * stashes them here); a later call with rel != 0 completes the entry + * and a rel == 0 call must NEVER wipe a stored release. + */ + if (!h || !prog || !param) return; for (i = 0; i < SVC_GL_HOLD_MAX; i++) { if (svc_gl_hold_tab[i].h == h) { @@ -7427,8 +7531,10 @@ static void svc_gl_hold_store(u32 h, u64 prog, u64 param, u32 psize, svc_gl_hold_tab[free].prog_va = prog; svc_gl_hold_tab[free].param_va = param; svc_gl_hold_tab[free].param_size = psize; - svc_gl_hold_tab[free].rel_va = rel; - svc_gl_hold_tab[free].rel_payload = rpay; + if (rel) { + svc_gl_hold_tab[free].rel_va = rel; + svc_gl_hold_tab[free].rel_payload = rpay; + } } static bool svc_gl_hold_load(u32 h, u64 *prog, u64 *param, u32 *psize, @@ -7770,7 +7876,30 @@ static void svc_gl_flush(struct nv_vgpu_device *vgpu, } if (!svc_gl.prog_va || !svc_gl.param_va || !svc_gl.rel_va) { - if (gsp_sema_dbg && svc_gl_skip_log < 16) { + /* + * SESSION 153-CONTINUED-13: the release may be + * decoded AFTER this section in ring order + * (the r955 init: the 24 B release pushes sit + * behind the 1524 B init push in the ring, so + * every replay pass of the section flushed + * before svc_gl.rel_va was known). When the + * operands are real but only the release is + * missing, stash them for the channel so the + * next section/pass (by then the constant + * release stream has been decoded) captures + * with src=hold instead of losing the init + * capture - without which the guest's GLX + * init completion degrades and the client + * never emits its draw pushes at all. + */ + if (svc_gl.prog_va && svc_gl.param_va && + !svc_gl.rel_va) + svc_gl_hold_store(ch->h_object, + svc_gl.prog_va, + svc_gl.param_va, + svc_gl.param_size, + 0, 0); + if (gsp_sema_dbg && svc_gl_skip_log < 2048) { svc_gl_skip_log++; pr_info("sema-gl: flush skip h=0x%x push=0x%llx prog=0x%llx param=0x%llx rel=0x%llx (no operands, no hold)\n", ch->h_object, push_va, @@ -12705,7 +12834,7 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf, * colour target, constant-buffer selectors). */ if (gsp_sema_gl_xlate && !ch->engine_type && trusted && - !svc_gl_att_h) { + !svc_gl_att_has(ch->h_object, 0)) { u32 o2 = 0; while (o2 + 4 <= len) { @@ -12717,8 +12846,7 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf, sc2 = (h2 >> 13) & 0x7; ad2 = (h2 & 0x1fff) << 2; if (op2 == 4 && ad2 == 0x1618 && sc2 == 0) { - svc_gl_att_h = ch->h_object; - svc_gl_att_subch = 0; + svc_gl_att_note(ch->h_object, 0); if (gsp_sema_dbg && svc_gl_draw_log < 64) { svc_gl_draw_log++; pr_info("sema-gl: attach-on-BEGIN h=0x%x push=0x%llx off=0x%x (no explicit C597 bind seen)\n", @@ -12760,13 +12888,17 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf, * the replay channel cannot translate (the r929 v1 fault * class), so they must stay outside the sliced window. */ - if (gsp_sema_gl_xlate && !ch->engine_type && - svc_gl_att_h == ch->h_object) { - if (subch != svc_gl_att_subch) - gl_win_start = 0; - else if (!gl_win_start && - !(op == 1 && addr >= 0x1b00 && addr <= 0x1b0c)) - gl_win_start = off; + if (gsp_sema_gl_xlate && !ch->engine_type) { + u32 as = svc_gl_att_subch_of(ch->h_object); + + if (as != 0xffu) { + if (subch != as) + gl_win_start = 0; + else if (!gl_win_start && + !(op == 1 && addr >= 0x1b00 && + addr <= 0x1b0c)) + gl_win_start = off; + } } /* @@ -13028,8 +13160,7 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf, */ if (gsp_sema_gl_xlate && !ch->engine_type && op == 4 && addr == 0x1618 && !svc_gl.seen && - svc_gl_att_h == ch->h_object && - subch == svc_gl_att_subch) { + svc_gl_att_has(ch->h_object, subch)) { u64 keep_rel = svc_gl.rel_va; u32 keep_pay = svc_gl.rel_payload; u32 wstart = gl_win_start ? gl_win_start : off; @@ -13061,8 +13192,7 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf, if (gsp_sema_gl_xlate && op == 4 && addr >= 0x2000 && addr < 0x2800 && (addr & 0x3f) == 0 && ((svc_gl.seen && subch == svc_gl.subch) || - (svc_gl_att_h == ch->h_object && - subch == svc_gl_att_subch))) { + svc_gl_att_has(ch->h_object, subch))) { u32 j = (addr - 0x2000) / 0x40; if (j < 32) @@ -13170,9 +13300,11 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf, * remember it so the class-space recognizer * (BEGIN 0x1618, below) accepts this channel's * later per-push-CONTENT pushes that carry no - * SET_OBJECT of their own. */ - svc_gl_att_h = ch->h_object; - svc_gl_att_subch = subch; + * SET_OBJECT of their own. + * SESSION 153-CONTINUED-13: per-channel table - + * a foreign channel's periodic C597 bind must + * not steal this channel's attachment. */ + svc_gl_att_note(ch->h_object, subch); /* * SESSION 153: witness every C597 section open * (bounded) - it is the recognizer-side proof @@ -13194,10 +13326,10 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf, /* A different class bound over the attached * subchannel replaces the C597 bind: drop the * attachment so the class-space recognizer - * cannot misread methods of the new class. */ - if (ch->h_object == svc_gl_att_h && - subch == svc_gl_att_subch) - svc_gl_att_h = 0; + * cannot misread methods of the new class. + * SESSION 153-CONTINUED-13: clears only this + * channel's entry. */ + svc_gl_att_clear(ch->h_object, subch); } } else if (gsp_sema_gl_xlate && svc_gl.seen && subch == svc_gl.subch) { -- cgit v1.2.3